Hash Generator · Security
Hash any text, locally, in a keystroke.
Compute MD5, SHA-1, SHA-256 and SHA-512 digests — plus an optional HMAC with a key — all through the Web Crypto API, entirely in your browser.
Hash generator playground
Hashed as UTF-8. The empty string is valid — its digests are well-known (MD5 d41d8cd9…).
HMAC key never leaves your browser.
Enter a secret to add a keyed HMAC-<algo> row below. Leave blank for plain digests only.
No share links on this tool — inputs may be secrets.
Type or paste text — or pick an example — to see its MD5, SHA-1, SHA-256 and SHA-512 digests here, each with a Copy button.
The Gap
One stray byte, a checksum that no longer matches.
Verifying a download, fingerprinting a payload or building an HMAC signature usually means reaching for a CLI you half-remember — and the moment you paste a secret into an online hasher, you are trusting an unknown server with it. Whether you need to generate a SHA-256 hash from text or produce a full set of digests at once, the maths is standard; the risk is where it runs.
This free hash calculator computes every digest right in the page through the browser’s native Web Crypto API (with a pure-JS routine for MD5, which the API omits on purpose), so you can calculate a hash of text online with no signup, confirm a checksum or sign a message without anything leaving your tab. Entirely in the browser, with nothing to install.
Reading a token instead of hashing one? The JWT Decoder splits and base64url-decodes its three parts for you.
The Pipeline
How it works.
Four deterministic steps run on every keystroke — all inside your browser tab, with the text read as UTF-8 before the bytes are digested.
-
Read the text as bytes.
Your input is encoded to UTF-8 first, so emoji and accents become the exact bytes the hash will consume.
-
Digest the bytes.
SHA-1, SHA-256 and SHA-512 run through the native Web Crypto API; MD5 runs in a pure-JS routine since the browser omits it.
-
Hex-encode the result.
The raw digest bytes are rendered as lowercase hexadecimal — the canonical form you compare against published checksums.
-
Sign with a key (optional).
Add a secret key and the same text is run through HMAC, producing a keyed code that proves authenticity, not just integrity.
Digest Reference
How big is each digest?
The algorithm alone fixes the digest length, never your input. Pick by security need — MD5 and SHA-1 are fast but broken, so keep them for non-adversarial checksums only.
Digest sizes
A digest is rendered as bits / 4 hexadecimal characters — so SHA-256 is 64 hex chars, SHA-512 is 128.
algorithm digest size hex chars security
MD5 128-bit 32 broken — checksums only
SHA-1 160-bit 40 broken — avoid for security
SHA-256 256-bit 64 recommended
SHA-512 512-bit 128 recommended
Note: MD5 and SHA-1 are unsafe for signatures, certificates
or passwords — both have practical collision attacks.
Use SHA-256 or SHA-512 for anything security-sensitive.Adding a key (HMAC)
A plain hash proves integrity; an HMAC mixes in a secret key to prove authenticity too — same text, a different keyed digest.
text "hello"
SHA-256 2cf24dba5fb0a30e26e83b2ac5b9e29e
1b161e5c1fa7425e73043362938b9824
HMAC-SHA-256 key="s3cret"
e5a01537481fa0b2c697f787c7aff885
412cf0760d08e08502259b39d2d6ae68
Same text, a key — a completely different, keyed digest.Next Step
Need to encode bytes, not fingerprint them?
A hash is one-way; when you need a reversible, text-safe representation of bytes, the Base64 Encoder / Decoder turns any text into base64url and back. And when that encoded value is a token, the JWT Decoder splits and decodes its three parts — both in your browser.
text "ops"
SHA-256 a92c...b132 ← one-way fingerprint
base64 b3Bz ← reversible encodingFAQ
Questions, answered.
Tap a question to expand the answer.
What is a hash generator and what does it do?
A hash generator computes a fixed-length digest — a fingerprint — of any input text using a one-way cryptographic function such as MD5, SHA-1, SHA-256 or SHA-512. The same input always yields the same hash, but the hash cannot be reversed back to the original text. It is used for data integrity checks, fingerprinting payloads, and verifying that content has not changed.
Which algorithms does this support, and what size is each digest?
It computes MD5 (128-bit, 32 hex characters), SHA-1 (160-bit, 40 hex), SHA-256 (256-bit, 64 hex) and SHA-512 (512-bit, 128 hex). SHA-1, SHA-256 and SHA-512 are computed by the browser native Web Crypto API; MD5 is computed in pure JavaScript because Web Crypto deliberately does not expose it. The digest length depends only on the algorithm, never on how long your input is.
Are MD5 and SHA-1 safe to use?
Not for anything security-sensitive. MD5 and SHA-1 are both broken against collision attacks — an attacker can craft two different inputs that share the same digest — so they must not be used for signatures, certificates or password storage. They are still fine as fast, non-adversarial checksums (for example, matching a file against a vendor-published MD5). For security, reach for SHA-256 or SHA-512.
Does my text ever leave my browser?
No. Every digest is computed locally through the Web Crypto API (and a pure-JS routine for MD5) inside your tab — there is no server, no account and no logging. You can safely hash tokens, config snippets or private data; nothing is ever uploaded over the network.
What is HMAC and how is it different from a plain hash?
HMAC (Hash-based Message Authentication Code) combines a hash function such as SHA-256 with a secret key to verify both the integrity and the authenticity of a message. Unlike a plain hash, an HMAC cannot be recomputed by someone who does not know the secret key, which is why it is used for API request signing and webhook verification. Provide a key in the HMAC field and the tool computes the keyed code alongside the plain digests, entirely in your browser via the Web Crypto API.
Can I generate MD5, SHA-1, SHA-256 and SHA-512 hashes at the same time?
Yes. Paste your text once and the tool computes the MD5, SHA-1, SHA-256 and SHA-512 digests together and displays them side by side — with optional HMAC output if you supply a secret key. This saves switching between separate single-algorithm tools whenever you need to generate MD5, SHA-1, SHA-256 and SHA-512 at once.
How do I generate a SHA-256 hash online for free?
Paste your text into the Hash Generator field above and the SHA-256 digest — a 64-character hexadecimal value representing 256 bits — is computed instantly in your browser using the Web Crypto API. It is free, requires no signup, and your input never leaves your device because nothing is uploaded to a server.
How do I verify a SHA-256 checksum?
Compute the hash of your file or text and compare it to the published checksum. On Windows run certutil -hashfile <file> SHA256 or Get-FileHash -Algorithm SHA256 <file> in PowerShell; on Linux use sha256sum <file>; on macOS use shasum -a 256 <file>. For text, paste it into the Hash Generator above and compare the SHA-256 output to the value from the source. If they match the content is intact and untampered.
Is SHA-256 reversible — can a hash be decrypted back to the original text?
No. SHA-256 and other cryptographic hash functions are one-way: a digest cannot be decrypted or reversed back to the original input. Sites that claim to "decrypt" a hash only look up the input in a precomputed database of common values (a rainbow table); they do not reverse the mathematics. If an input does not appear in their database, it cannot be recovered.
More free, private DevOps tools.
The Hash Generator is one tool in OpsCanopy — a growing canopy of browser-based validators, converters and testers that never touch a server.
More in Security
New to Linux? Read the Linux guide →
29 free tools, every one offline-capable — opscanopy.com works with no signup and nothing uploaded.
Related tools: the Base64 Encoder / Decoder and the JWT Decoder, or browse the full tools directory.
Provided as-is for convenience; MD5 and SHA-1 are broken and must not be used for security. Always confirm critical integrity checks against a trusted source. OpsCanopy is free and open.